Analysis
-
max time kernel
134s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
13/06/2024, 15:09
Static task
static1
Behavioral task
behavioral1
Sample
a62e82366b6943d7cfb569bf9d584f43_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
a62e82366b6943d7cfb569bf9d584f43_JaffaCakes118.html
Resource
win10v2004-20240611-en
General
-
Target
a62e82366b6943d7cfb569bf9d584f43_JaffaCakes118.html
-
Size
2KB
-
MD5
a62e82366b6943d7cfb569bf9d584f43
-
SHA1
361e906413ff04c38c23bdf92097aad116b050a2
-
SHA256
9f723b7297e7a950e21f25f308acdb8b2de4edaf7ea4f01d154092b10cc99eb3
-
SHA512
35b4a285f19f1823025af668608dfaf129b6082f5e3aaf9d58ca230c78129a400d686738416a2a43bcd18a79f101976c360e65ff1b78b9ca0f5be99c2d1bbae9
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bf9d143dae5a3145b13279437bcd069c000000000200000000001066000000010000200000000ff0bf015fd7a28985863d31daf9ad462bdf8c47c8a64425d6d9218c47b9baf5000000000e80000000020000200000008385c5e0a92aa202ad9b0bc2c6a0fb9dd43560b4c9bb6fe0a09a7dd1b929501a2000000060beb10ff330feaa409c6104ec618421f0fd658b3e87736dac030fa9fe530c8540000000fceab409d7074de485533c324a75216ae5dbdef151799eb4867e50f9a9e6cd94efdac3c24dc9499b414fdeae0974c92dfb9b7de1d2e966476ba55c6047f53da7 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424453246" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F3C03561-2996-11EF-995F-5A791E92BC44} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bf9d143dae5a3145b13279437bcd069c00000000020000000000106600000001000020000000612bc50ca603461997b9506e14498ea52a88b071a39b9d9103fb7cc3e6d1ee2a000000000e80000000020000200000009b91c361924e9e43a5b0831017b2eb4ce1be85421765695ce2011c55efd1afe69000000021151dddb44ad8d8bfa49da80c644de6475d8fcaa27615aa835dfc710619c24e8faee7d2c00a6331325bbd212cb2d2b87ab132fb5f378fb3aaff31feb51c5cfea44f70ce01d5226dbb99b07f21e8463435dd17bb33f9e43493320527dd5493478ba5cf1fceb4ce47c43b229c72e050f1a5ac9bf84080d8ea386380f3924816de73329dd8831b1b1c15b21c73b1c93960400000006b44f2fff7091383ee8e118db7db54a2388be6d675b7431df8c6ecb816568aa837c9e2e9028857179c4baea858c54c201692be0ca07c4e90de2aa62a40e87330 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00b3aac8a3bdda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2292 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2292 iexplore.exe 2292 iexplore.exe 1376 IEXPLORE.EXE 1376 IEXPLORE.EXE 1376 IEXPLORE.EXE 1376 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2292 wrote to memory of 1376 2292 iexplore.exe 28 PID 2292 wrote to memory of 1376 2292 iexplore.exe 28 PID 2292 wrote to memory of 1376 2292 iexplore.exe 28 PID 2292 wrote to memory of 1376 2292 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a62e82366b6943d7cfb569bf9d584f43_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2292 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1376
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e79d9cc2b3269a50cb7a42018372d177
SHA1b90f0168f9fd0a5f58b345162099002c28f09437
SHA2567c703d75d7c1296b6efb77a47b3d4c63efba6a2d86ab94ab924515a75ddebdd0
SHA512ae64ce9b29bc3c0f838531a9bd85f905e2d0108f57b60c36e62693372593bd3ad68ae1704535dd77d0485ed33b9c96c5d867dd97d72a449e9ce44a607f542717
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50363af18a81156e3ca78dc699c68df52
SHA1525fadc33b9d348e74d21139504baeadf24d68fd
SHA25673a8a6d4fdd8ecf772a620d9097d10e3e5a6cbfa5a6e05c708884c1f18fe43c2
SHA5125f3663e4b4949a6b2429d45adaa12e1ad6eeb69d75c0e1f949f3ee9fae8eec0cb35f8a9ff6c58bf622bd5eda7a81709a8906626fda0fe9e8f92256c257c68b26
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD534b1262b5c8b262e7331c1b1b6240d2c
SHA11d15047619771728f9f1bf6d2676c728eeed84de
SHA2560f74c7d8c7addde452312a7a6cb424e387a84f6ad9f091315715e9c6aa34bbbc
SHA51228942d3cc8d7155d3464851bc3b0a4e5d88bfff47b5eb61c9d136a9c50651c94847a191877e90fa0ac363895a5894626085f96a3e4f48f41d12d47dc33152336
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c30abeb07938e69208f15805c1400eb3
SHA1d3e6d37e18e2e6f15791c84897873396d1875eb7
SHA2566359e7a8586bb4f6492cbd24b7aeeecf64755b9f86d76649cdc0d9747e2365b1
SHA512b74f51602b126ffff524dbb3f4dc06888caf2865e955e552444d39462e25c6c8cf10199d54ea08b9261d28d717edd23c68e854dc60a1e1f545fd39e97660a470
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD535382923b72d7bc8520791785512c113
SHA195257f98a3de9b2803f2c4e7d27bfa1be28e0e3c
SHA2567ae413a1fe207219f00b569d9523f460a775c1f1ce8685ada109b520dd3d68b9
SHA5120c28bd04bdfa5fde1f86418506bec22f7fe74e08a62ddd3b10b7f699f89d3d682a99b10a10e041be077ed6b722aadeeaf2b02f95bff1ba8f039efb252e80fb6b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57822ef64dd631ba1d0d46833be2e327a
SHA1deca6581ef4d96deac3457ce272fd0c17ce387c1
SHA25650caf8fb7253df02c80e72d9acca7c3d23e1527b6abe94cde767177a8a0b83c4
SHA512359d1ea6f8b1a00168c4e5ffcfac9d338a3e7bbcec662803547863285682db85d03793862bc3e8f677ba72539a53e21aedb11070f588a41477ae1d52f1db4018
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57f5a2756e7aced67e5b8e5cc4c1bc695
SHA1a5a5552203acc09542d82c4d1cb9656b251fa6af
SHA256b786a4b34221ed3c56adec57d6e358a7969fd0187d428bdc0157f9c627056d25
SHA512e6b03afa596f72c8c69588b881764161105da49bb84fb4ab933ff70b4b2f5b2de9abc617a2f077ce81fd1445ece76fefab5d657a79e06ee54ee0809af552774b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD533821381dd6155de5c3cab18d37ba45b
SHA10a5350c96f00f09917a1978353ce55d46749b03a
SHA2569b1cac055c7e6599102edb44ea6979c3f43ce685515772ee034ad72f14faf5cc
SHA5126ca6d72e0499a9ec89bb2ef1c02da74ef243cba9112d4ca245cf2a84b630be6f64c43fbf25bdf5ec5302ec0e57df470029c656995c88c90abce1d073ae9147ee
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5db1fc21668cdba7188437c40a880e426
SHA1f19815ccf71b8a8f8187d85e9ddeb190f6440fc0
SHA2562467434d0b12a5370678e97ab90ae5a90e9b5a1dd6d52c3242ebf06ebf631966
SHA512dd0b371445693007e2d54fff7002a46ab1aad05dc972fd11e2fe28ce513dfe634de97b96fd1e7df96462841622a1fbabd9b97f629ee8be6cd582dfb346c80221
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53f5ea9d65135c736079ba7c22eacad4c
SHA19900a792f0f2f0603a235900facd171c2df9ef13
SHA256fd1bdae53f8824c8cbaccba1a38e56d23e46aa3f42d17c4baa06cc5cdd0543b4
SHA5127e1ed6502cca2aa409c1b39b537139d168f4e047ef356c1bb92c664a46d21c6ce50061ff4aa16ffabd0b6f9cc6fc4244108bbb3bfdcf56a74cfc8334067b01f6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d15fd3d239f90638eeaac8bc7f4c1b9f
SHA184c6b2286a67e0ab543eb8f59638f172a4ddbe5f
SHA256a942b9820e659439279e471842f0faad6e43895af6cd527bb8c4c57b4b102b9f
SHA5120604b7c90ebf53b119b7703ef1bd1918ea6f5a69562aa59deec7e4b438a395a8476962669f6a5f076a3a3644443e5a428cb71be957490692a80bd184a9b3b0f0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD547eef33e1e86e312f3536f25ecbe7189
SHA14fb630c0a17c567319a007a9a496e3919bdbfb12
SHA2569e7139c810db70118d04e1c6fce2530506576002065782d8ee2feb4d8d476837
SHA512dbde6584964a84abfa02b3a91f37543ffa951fbbc1010e55907cc4e258f529df74cd576864dd547aae8e142b8b4964eb8151780aaa9b94d4b79bcf110a7c5f62
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56670459bfce4cdd755487a167adb120b
SHA1a9989ffd7f8219e6258a1ad6d195317954847ff3
SHA2563efcf187fe1ae70853dd140a3726388f1d6891b29850e3514b1b9e254e45b5dd
SHA512782380e3f904ada636f9416150028edd0c088d8b9a5573bfc3f40c6db78ed2a7b5b28aed314859a147e9ae028637f1bc74803cf5fec3ba54439007df0a38959d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b8e0aa78c1df171a6467690b05b43620
SHA1dcb61ffe84b1ece30cd8f253d3f45e3ef75ea0c3
SHA25602bddcbcf68c96e2469160206abda0e520e6e20cff54b493c589dd6ffea76626
SHA512f94a7cba62f140f19bc1d720b53543f066b040aff13b0511d18b056624271b3561c545aede9b846076c7bd0232a297e429bf8db16fc6a3e837e8160045371bb9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bf82a23192dc4a0cd57b77c60695a35f
SHA149a5e1b213bfa5addd1ec682ee33708e0ad23c64
SHA2566afe3de7a3d8b757a52eb9eef02323bc29ec1ebd2c79cbb818ed21f4ce52b356
SHA512a3230fff71c48024af304b31b4f55d001b830a2626dc4912ce68f5a28fbc478b5a763625ea5460c265a3e550517ee5016815fc0b7b932a57f5322d1bd926d160
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD570b961ca732a4abb2a61abab78a35b59
SHA1c5be296ad5bb77544a8ced030792f2b50ff4fee2
SHA256a0f21dad167ef32d64d0613d280adb983efcf4b05bf97c68ae45f236aab82a94
SHA51208e3d511484902a822745c734ac5522007667b59fa8fe62c17a0e07cbcbfd856b6a2da317b6911fd0f775a5aa82a8431be6f549415cd9fb5d494bdbe7f59bd1d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e547c4185a53a7d56ea95dcc38b18d01
SHA1602e1cfb661f2ad20670da0ce9122ed6490044d0
SHA256c550590e5e240623c78c94b62cc69bdf369f32c479dea350e4b45d5e6104e73c
SHA512ce32d7137029a5466d63d196b8f4fc7a2aff38fa4949cb9fa9c89e07398d267c2eb043be40eb2ed634438d62b48fc8c9e7d6722c483acf3b6101d7d375ead745
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5322c5cb249359595644bd587664797ff
SHA137b8274dc46417224c4e60f4dcd66e9de4dda317
SHA256460263a3906089aa758636bea144f131c834b86780de11dea14e7f8fb68c0bd2
SHA512c805a022a5aef121e28aa203fa0a2f08191f95b81d42e81b0c88180bb76e2304ba2e5414be13c0755420afcfcafd70e1b16ea46935d00c1af6dadb171ad7a0fc
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b